In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf
Part of the recommendations for site owners is the publication of a disclosure policy, in a public area, to state the company's position in terms of reaction to security researchers. I drafted a Vulnerability Disclosure Policy based on the New Zealand Registry Services' policy here: https://nzrs.net.nz/about/vulnerability-disclosure-policy
My employer is in retail, and the managing director doesn't want to publish this on the website, for fear of frightening customers off our website. As a partial solution, we agreed to insert references to the document as comments in our website's source code, as well as in the HTTP headers on our webserver.
Are these enough? Are there any other places we should publish which won't be visible to our average visitor, but WILL be visible to those who should see this policy?